CVE-2021-30166 MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command Injection

High 7.2 Published 28 Apr 2021 Updated 17 Sep 2024

Remote attackers with privileged access can execute arbitrary commands via the NTP Server configuration function in LILIN IP cameras.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-30166?

CVE-2021-30166 is a high-severity command injection vulnerability in MERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera firmware, published on 28 Apr 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission.

Weakness: CWE-78

Which versions are affected by CVE-2021-30166?

It affects 41 products.

Products include Meritlilin P2g1022 Firmware, Meritlilin P2g1022x Firmware, Meritlilin P2g1052 Firmware, Meritlilin P2r3022ae2 Firmware, Meritlilin P2r3052ae2 Firmware, Meritlilin P2r6322ae2 Firmware and 35 more.

How do I fix CVE-2021-30166?

No fix has been published for CVE-2021-30166 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2021-30166 being exploited?

There is no known exploitation of CVE-2021-30166 in the wild and no public exploit code.

Sources

Also known as GHSA-3g9r-wrp4-36rm.